CISA warns of actively exploited SharePoint vulnerabilities
Three critical flaws being used in attacks, agency confirms
1Critical Alert
The US Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning about three actively exploited vulnerabilities in SharePoint servers. Organizations must update all supported SharePoint versions immediately.
2Vulnerability Details
CVE-2026-32201 (6.5) spoofing, CVE-2026-45659 (8.8) remote code execution, and CVE-2026-56164 (5.3) privilege escalation flaws are being used to steal IIS machine keys and deploy malware in post-exploitation activities.
3Additional Threats
CISA highlighted two more critical vulnerabilities (CVE-2026-55040 and CVE-2026-58644) from the latest Patch Tuesday. While Microsoft labeled them as 'more likely to be exploited,' no active attacks have been reported yet.
4Attack Patterns
The agency noted similarities with 2025 'ToolShell' attacks. Chinese state-sponsored groups were previously reported chaining these vulnerabilities to distribute Warlock ransomware.
5Mitigation Steps
Immediate recommendations include applying Microsoft's latest security patches, verifying AMSI integration, rotating IIS keys, and blocking external access to SharePoint Central Administration.
6Proactive Defense
CISA advises organizations to hunt for intrusion signs and implement robust logging systems. SharePoint's prevalence in critical infrastructure makes these warnings particularly significant for enterprise security.